JPMorgan's 2014 Hack Tied to Vast Cybercrime Enterprise

JPMorgan Chase & Co. and Dow Jones & Co. were among the targets of the biggest theft of customer data from U.S. financial institutions in history, prosecutors said in announcing charges against four men accused of running online schemes including stock manipulation and casino gambling that generated hundreds of millions of dollars.

The new allegations against the four, all previously charged, broaden dramatically the scope of a wide-ranging criminal enterprise with hacking at its core. In two indictments, prosecutors say the defendants targeted financial institutions, publishers, online stock brokers and software firms.

They worked with crooked stock promoters to pump up share prices, ran at least 12 online casinos, laundered money and operated an unlawful bitcoin exchange, according to the indictment.

The hackers stole data of more than 100 million customers around the world, prosecutors said. Almost all their schemes, including the market manipulation, “relied for their success on computer hacking and other cybercrimes,” according to the indictment.

The defendants include alleged ringleader Gery Shalon and two others, Joshua Aaron and Ziv Orenstein. A second indictment accuses Anthony Murgio of conspiracy to operate an unlicensed bitcoin business called Coin.mx. Murgio was previously arrested in Florida. Shalon and Orenstein were arrested in Israel in August.

Fighting Cybercrime

“We continue to cooperate with law enforcement in fighting cybercrime,” JPMorgan spokeswoman Trish Wexler said in a statement. The hack occurred last year.

Another victim was Fidelity Investments of Boston. Vincent Loporchio, a spokesman, said in a statement “there is no indication that our customers were affected.”

The market manipulation scheme ran from 2012 to mid-2015. In addition to the hacks on the U.S. financial sector, the defendants targeted other companies and laundered their “vast criminal proceeds” through at least 75 shell entities, according to the indictment.

U.S. Attorney Preet Bharara in Manhattan has scheduled a press conference for Tuesday to explain the charges.

Network Intrusions

According to the indictment, one of the defendants “directed network intrusions” into 12 targets and stole personal information “of over 100 million customers” of the companies.

Dow Jones, the parent company of The Wall Street Journal, confirmed the hack on its website, citing sources. Other victims include online brokerages E*Trade FinancialCorp. and Scottrade Inc., according to the companies.

Murgio was previously tied to a cyber-attack on JPMorgan in an FBI memo.